This module sets up basic network components for an account in a specific region. Optionally it will setup a basic VPN gateway and VPC flow logs.
module "vpc" {
source = "[email protected]:rackspace-infrastructure-automation/aws-terraform-vpc_basenetwork//?ref=v0.0.5"
vpc_name = "MyVPC"
}
Full working references are available at examples
By default only vpc_name is required to be set. Unless changed aws_region defaults to us-west-2 and will need to be updated for other regions. source will also need to be declared depending on where the module lives. Given default settings the following resources are created:
- VPC Flow Logs
- 2 AZs with public/private subnets from the list of 3 static CIDRs ranges available for each as defaults
- Public/private subnets with the count related to custom_azs if defined or region AZs automatically calculated by Terraform otherwise
- NAT Gateways will be created in each AZ's first public subnet
- EIPs will be created in all public subnets for NAT gateways to use
- Route Tables, including routes to NAT gateways if applicable
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| az_count | Number of AZs to utilize for the subnets | string | "2" |
no |
| build_flow_logs | Whether or not to build flow log components in cloud watch logs | string | "false" |
no |
| build_nat_gateways | Whether or not to build a NAT gateway per AZ | string | "true" |
no |
| build_s3_flow_logs | Whether or not to build flow log components in s3 | string | "false" |
no |
| build_vpn | Whether or not to build a VPN gateway | string | "false" |
no |
| cidr_range | CIDR range for the VPC | string | "172.18.0.0/16" |
no |
| custom_azs | A list of AZs that VPC resources will reside in | list | <list> |
no |
| custom_tags | Optional tags to be applied on top of the base tags on all resources | map | <map> |
no |
| default_tenancy | Default tenancy for instances. Either multi-tenant (default) or single-tenant (dedicated) | string | "default" |
no |
| domain_name | Custom domain name for the VPC | string | "" |
no |
| domain_name_servers | Array of custom domain name servers | list | <list> |
no |
| enable_dns_hostnames | Whether or not to enable DNS hostnames for the VPC | string | "true" |
no |
| enable_dns_support | Whether or not to enable DNS support for the VPC | string | "true" |
no |
| environment | Application environment for which this network is being created. e.g. Development/Production | string | "Development" |
no |
| logging_bucket_access_control | Define ACL for Bucket from one of the canned ACL: private, public-read, public-read-write, aws-exec-read, authenticated-read, bucket-owner-read, bucket-owner-full-control, log-delivery-write | string | "bucket-owner-full-control" |
no |
| logging_bucket_encryption | Enable default bucket encryption. i.e. AES256 | aws:kms | string | "AES256" |
| logging_bucket_encryption_kms_mster_key | The AWS KMS master key ID used for the SSE-KMS encryption. This can only be used when you set the value of sse_algorithm as aws:kms. | string | "" |
no |
| logging_bucket_force_destroy | Whether all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. ie. true | string | "false" |
no |
| logging_bucket_name | Bucket name to store s3 flow logs. If empty, to create random bucket name. In conjuction with build_s3_flow_logs | string | "" |
no |
| logging_bucket_prefix | The prefix for the location in the S3 bucket. If you don't specify a prefix, the access logs are stored in the root of the bucket. | string | "" |
no |
| logging_bucket_retention | The number of days to retain load balancer logs. 0 to ratain forever. | string | "14" |
no |
| private_cidr_ranges | An array of CIDR ranges to use for private subnets | list | <list> |
no |
| private_subnet_names | Text that will be included in generated name for private subnets. Given the default value of ["Private"], subnet names in the form "<vpc_name>-Private<count+1>", e.g. "MyVpc-Public2" will be produced. Otherwise, given a list of names with length the same as the value of az_count, the first az_count subnets will be named using the first string in the list, the second az_count subnets will be named using the second string, and so on. |
list | <list> |
no |
| private_subnet_tags | A list of maps containing tags to be applied to private subnets. List should either be the same length as the number of AZs to apply different tags per set of subnets, or a length of 1 to apply the same tags across all private subnets. | list | <list> |
no |
| private_subnets_per_az | Number of private subnets to create in each AZ. NOTE: This value, when multiplied by the value of az_count, should not exceed the length of the private_cidr_ranges list! |
string | "1" |
no |
| public_cidr_ranges | An array of CIDR ranges to use for public subnets | list | <list> |
no |
| public_subnet_names | Text that will be included in generated name for public subnets. Given the default value of ["Public"], subnet names in the form "<vpc_name>-Public<count+1>", e.g. "MyVpc-Public1" will be produced. Otherwise, given a list of names with length the same as the value of az_count, the first az_count subnets will be named using the first string in the list, the second az_count subnets will be named using the second string, and so on. |
list | <list> |
no |
| public_subnet_tags | A list of maps containing tags to be applied to public subnets. List should either be the same length as the number of AZs to apply different tags per set of subnets, or a length of 1 to apply the same tags across all public subnets. | list | <list> |
no |
| public_subnets_per_az | Number of public subnets to create in each AZ. NOTE: This value, when multiplied by the value of az_count, should not exceed the length of the public_cidr_ranges list! |
string | "1" |
no |
| spoke_vpc | Whether or not the VPN gateway is a spoke of a Transit VPC | string | "false" |
no |
| vpc_name | Name for the VPC | string | n/a | yes |
| Name | Description |
|---|---|
| default_sg | The ID of the default SG for the VPC |
| flowlog_log_group_arn | The ARN of the flow log CloudWatch log group if one was created |
| internet_gateway | The ID of the Internet Gateway |
| nat_gateway | The ID of the NAT Gateway if one was created |
| nat_gateway_eip | The IP of the NAT Gateway if one was created |
| private_route_tables | The IDs for the private route tables |
| private_subnets | The IDs for the private subnets |
| public_route_tables | The IDs for the public route tables |
| public_subnets | The IDs of the public subnets |
| vpc_id | The ID of the VPC |
| vpn_gateway | The ID of the VPN gateway if one was created |